aboutsummaryrefslogtreecommitdiffstats
path: root/cron-sh/security_check.sh
diff options
context:
space:
mode:
Diffstat (limited to 'cron-sh/security_check.sh')
-rwxr-xr-xcron-sh/security_check.sh279
1 files changed, 279 insertions, 0 deletions
diff --git a/cron-sh/security_check.sh b/cron-sh/security_check.sh
new file mode 100755
index 0000000..5dffc48
--- /dev/null
+++ b/cron-sh/security_check.sh
@@ -0,0 +1,279 @@
+#!/bin/bash
+
+#
+# Basic security checking for suid files.
+# Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
+#
+
+if [ -f /etc/security/msec/security.conf ]; then
+ . /etc/security/msec/security.conf
+else
+ exit 1
+fi
+
+if [ SECURITY_CHECK == "no" ]; then
+ exit 0
+fi
+
+SECURITY_LOG="/tmp/secure.log"
+SECURITY="/var/log/security.log"
+TMP="/tmp/secure.tmp"
+
+if [ ! -d /var/log/security ]; then
+ mkdir /var/log/security
+fi
+
+chattr -a /var/log/security/ >& /dev/null
+chattr -a /var/log/security/* >& /dev/null
+rm -f ${SECURITY_LOG} ${TMP} >& /dev/null
+
+### Functions ###
+
+Syslog() {
+ if [ $SYS_LOG=="yes" ]; then
+ cat ${1} | while read line; do
+ /sbin/initlog --string="${line}"
+ done
+ fi
+}
+
+Ttylog() {
+ if [ $TTY_LOG=="yes" ]; then
+ for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do
+ echo -e "$1" > /dev/$i
+ done
+ fi
+}
+
+### Writeable file detection
+if [ ${CHECK_WRITEABLE}=="yes" ]; then
+ find ${DIR} -xdev -type f -perm -2 -ls -print | awk '{print $11}' | sort > ${TMP}
+
+ if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: World Writeable Files found :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ fi
+fi
+
+### Search Un Owned file
+if [ ${CHECK_UNOWNED}=="yes" ]; then
+ find ${DIR} -xdev -nouser -print -ls | awk '{print $11}' | sort > ${TMP}
+ if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning : the following file aren't owned by any user :\n" >> ${SECURITY_LOG}
+ printf "\ttheses files now have user \"nobody\" as their owner." >> ${SECURE_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ cat ${TMP} | while read line; do chown nobody ${line}; done
+ fi
+
+ find $DIR -xdev -nogroup -print -ls | awk '{print $11}' | sort > ${TMP}
+ if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning : the following file aren't owned by any group :\n" >> ${SECURITY_LOG}
+ printf "\ttheses files now have group \"nogroup\" as their group owner." >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ cat ${TMP} | while read line; do chgrp nogroup ${line}; done
+ fi
+fi
+
+if [ ${CHECK_PERMISSIONS}=="yes" ]; then
+# Files that should not be owned by someone else or readable.
+list=".netrc .rhosts .shosts .Xauthority .pgp/secring.pgp .ssh/identity .ssh/random_seed"
+awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
+while read uid homedir; do
+ for f in ${list} ; do
+ file="${homedir}/${f}"
+ if [ -f ${file} ] ; then
+ printf "${uid} ${f} `ls -ldcg ${file}`\n"
+ fi
+ done
+done | awk '$1 != $5 && $5 != "root" \
+ { print "\t\tuser=" $1 ", file=" $2 " : file is owned by " $5 }
+ $3 ~ /^-...r/ \
+ { print "\t\tuser=" $1 ", file=" $2 " : file is group readable" }
+ $3 ~ /^-......r/ \
+ { print "\t\tuser=" $1 ", file=" $2 " : file is other readable" }
+ $3 ~ /^-....w/ \
+ { print "\t\tuser=" $1 ", file=" $2 " : file is group writeable" }
+ $3 ~ /^-.......w/ \
+ { print "\t\tuser=" $1 ", file=" $2 " : file is other writeable" }' > ${TMP}
+
+if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: these files shouldn't be owned by someone else or readable :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+
+### Files that should not be owned by someone else or writeable.
+list=".bashrc .bash_profile .bash_login .bash_logout .cshrc .emacs .exrc \
+.forward .klogin .login .logout .profile .tcshrc .fvwmrc .inputrc .kshrc \
+.nexrc .screenrc .ssh .ssh/config .ssh/authorized_keys .ssh/environment \
+.ssh/known_hosts .ssh/rc .twmrc .xsession .xinitrc .Xdefaults"
+awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
+while read uid homedir; do
+ for f in ${list} ; do
+ file="${homedir}/${f}"
+ if [ -f $file ] ; then
+ printf "$uid ${f} `ls -ldcg ${file}`\n"
+ fi
+ done
+done | awk '$1 != $5 && $5 != "root" \
+ { print "\t\t- user=" $1 ", file=" $2 " : file is owned by " $5 }
+ $3 ~ /^-....w/ \
+ { print "\t\t- user=" $1 ", file=" $2 " : file is group writeable" }
+ $3 ~ /^-.......w/ \
+ { print "\t\t- user=" $1 ", file=" $2 " : file is other writeable" }' > ${TMP}
+
+if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: theses files should not be owned by someone else or writeable :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+### Check home directories. Directories should not be owned by someone else or writeable.
+awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
+while read uid homedir; do
+ if [ -d ${homedir}/ ] ; then
+ file=`ls -ldg ${homedir}`
+ printf "$uid $file\n"
+ fi
+done | awk '$1 != $4 && $4 != "root" \
+ { print "user=" $1 " : home directory is owned by " $4 }
+ $2 ~ /^-....w/ \
+ { print "user=" $1 " : home directory is group writeable" }
+ $2 ~ /^-.......w/ \
+ { print "user=" $1 " : home directory is other writeable" }' > ${TMP}
+
+if [ -s $TMP ] ; then
+ printf "\nSecurity Warning: these home directory should not be owned by someone else or writeable :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+fi
+fi
+
+if [ ${CHECK_SECURITY}=="yes" ]; then
+### Passwd file check
+if [ ${CHECK_PASSWD}=="yes" ]; then
+ awk -F: '{
+ if ( $2 == "" )
+ printf("\t\t- /etc/passwd:%d: User \"%s\" has no password !\n", FNR, $1);
+ else if ($2 !~ /^[x*!]+$/)
+ printf("\t\t- /etc/passwd:%d: User \"%s\" has a real password (it is not shadowed).\n", FNR, $1);
+ }' < /etc/passwd > ${TMP}
+
+ if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: /etc/passwd check :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ fi
+fi
+
+### Shadow password file Check
+if [ ${CHECK_SHADOW}=="yes" ]; then
+ awk -F: '{
+ if ( $2 == "" )
+ printf("\t\t- /etc/shadow:%d: User \"%s\" has no password !\n", FNR, $1);
+ }' < /etc/shadow > ${TMP}
+
+ if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: /etc/shadow check :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ fi
+fi
+
+### File systems should not be globally exported.
+if [ -s /etc/exports ] ; then
+ awk '{
+ if (($1 ~ /^#/) || ($1 ~ /^$/)) next;
+ readonly = 0;
+ for (i = 2; i <= NF; ++i) {
+ if ($i ~ /^-ro$/)
+ readonly = 1;
+ else if ($i !~ /^-/)
+ next;
+ }
+ if (readonly) {
+ print "\t\t- Nfs File system " $1 " globally exported, read-only.";
+ } else print "\t\t- Nfs File system " $1 " globally exported, read-write.";
+ }' < /etc/exports > ${TMP}
+
+ if [ -s ${TMP} ] ; then
+ printf "\nSecurity Warning: Some NFS filesystem are exported to globally :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ fi
+fi
+
+### nfs mounts with missing nosuid
+/bin/mount | /bin/grep -v nosuid | /bin/grep ' nfs ' > ${TMP}
+if [ -s ${TMP} ] ; then
+ printf "\nSecurity Warning: The following NFS mounts haven't got the nosuid option set :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+### Files that should not have + signs.
+list="/etc/hosts.equiv /etc/shosts.equiv /etc/hosts.lpd"
+for file in $list ; do
+ if [ -s ${file} ] ; then
+ awk '{
+ if ($0 ~ /^\+@.*$/)
+ next;
+ if ($0 ~ /^\+.*$/)
+ printf("\t\t- %s: %s\n", FILENAME, $0);
+ }' ${file}
+ fi
+done > ${TMP}
+
+awk -F: '{print $1" "$6}' /etc/passwd |
+ while read username homedir; do
+ for file in .rhosts .shosts; do
+ if [ -s ${homedir}/${file} ] ; then
+ awk '{
+ if ($0 ~ /^\+@.*$/)
+ next;
+ if ($0 ~ /^\+.*$/)
+ printf("\t\t- %s: %s\n", FILENAME, $0);
+ }' ${homedir}/${file}
+ fi
+ done >> ${TMP}
+ done
+
+if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: '+' character found in hosts trusting files,\n" >> ${SECURITY_LOG}
+ printf "\tthis probably mean that you trust certains users/domain\n" >> ${SECURITY_LOG}
+ printf "\tto connect on this host without proper authentication :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+### executables should not be in the aliases file.
+list="/etc/aliases /etc/postfix/aliases"
+for file in ${list}; do
+ if [ -s ${file} ]; then
+ grep -v '^#' /etc/aliases | grep '|' | while read line; do
+ printf "\t\t- ${line}\n"
+ done > ${TMP}
+ fi
+
+ if [ -s ${TMP} ]; then
+ printf "\nSecurity Warning: The following programs are executed in your mail\n" >> ${SECURITY_LOG}
+ printf "\tvia ${file} files, this could lead to security problems :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ fi
+done
+
+### Dump a list of open port.
+if [ ${CHECK_OPEN_PORT}=="yes" ]; then
+ netstat -pvlA inet > ${TMP};
+
+ if [ -s ${TMP} ]; then
+ printf "\nThese are the ports listening on your machine :\n" >> ${SECURITY_LOG}
+ cat ${TMP} >> ${SECURITY_LOG}
+ fi
+fi
+fi # end of CHECK_SECURITY
+
+### Report
+if [ -s ${SECURITY_LOG} ]; then
+ Syslog ${SECURITY_LOG}
+ Ttylog ${SECURITY_LOG}
+ cat ${SECURITY_LOG} >> ${SECURITY}
+fi
+
+
+
+
+